Cloud Networking Basics

The same ideas on someone else's hardware

Cloud networking is not a new subject. It uses everything you have already learned (IP addresses, subnets, routing and firewalls), but the switches, routers and firewalls are software settings instead of physical boxes. When you rent a server on AWS, Azure or Google Cloud, you also design the network around it, using a web console or code.

The terms below use AWS names. Azure and Google Cloud have close equivalents with slightly different names.

VPC: your private network in the cloud

A VPC (Virtual Private Cloud) is a private, isolated network inside the cloud provider's data centres. You choose its IP range, for example 10.0.0.0/16, and everything you create lives inside it. Other customers cannot reach your VPC unless you allow it.

Inside a VPC you create subnets:

• Public subnet: for resources that must be reachable from the internet, such as a web server or a load balancer.
• Private subnet: for resources that should not be reachable directly from the internet, such as a database.

Getting in and out

• An Internet Gateway connects your VPC to the internet. Resources in a public subnet use it for two-way traffic.
• A NAT Gateway lets machines in a private subnet reach out to the internet, for example to download updates, without letting the internet start connections in.

This is the same NAT you met in the routers lesson, provided as a managed service.

Route tables: what makes a subnet public

A subnet is not public or private by itself. That depends on its route table, a list of routes like the one in the routers lesson.

Public subnet route table
10.0.0.0/16   local
0.0.0.0/0     Internet Gateway

Private subnet route table
10.0.0.0/16   local
0.0.0.0/0     NAT Gateway

The public subnet's default route points to the Internet Gateway, so its servers can be reached from outside. The private subnet's default route points to the NAT Gateway, so its servers can start connections to the internet, but the internet cannot start connections to them. The local route means machines inside the VPC can always reach each other.

Security groups and network ACLs

Cloud firewalls come in two layers:

• A security group works at the server level. It is a stateful list of what is allowed in and out of that instance, and everything not allowed is denied.
• A network ACL works at the subnet level. It is an extra stateless layer of rules.

A typical secure setup:

• Web server security group: allow ports 80 and 443 from anywhere.
• Database security group: allow port 3306 only from the web server, and nothing else.

DNS in the cloud

Cloud providers offer managed DNS services, for example Route 53 on AWS and Cloud DNS on Google Cloud. You keep your records there, and the service answers queries quickly from many locations. Inside a VPC, servers can also find each other by name instead of by address.

Load balancers

When a website gets busy, one server is not enough. A load balancer receives the visitors and distributes them across several servers.

It also checks the health of each server. If one fails, the load balancer stops sending visitors to it, and users usually never notice. A load balancer also gives you a single address and a single place to install the HTTPS certificate.

A typical three-tier layout

Many real applications are split into three tiers, each in its own place:

1. Load balancer in the public subnet, accepting HTTPS from the internet.
2. Application servers in a private subnet, accepting traffic only from the load balancer.
3. Database in another private subnet, accepting traffic only from the application servers.

Each tier's security group names the tier in front of it as the only allowed source. If an attacker breaks into the web tier, they still cannot reach the database straight from the internet. Using several layers of protection like this is called defence in depth.

Connecting the cloud to your own network

Companies rarely move everything at once, so a cloud network often has to connect to the office network.

• Site-to-site VPN: an encrypted tunnel over the internet. Quick to set up and cheap.
• Dedicated link: a private line from your office or data centre to the provider. More stable and faster, but it costs more.
• VPC peering: connects two VPCs so they can talk using private addresses.

Plan the IP ranges before you connect anything. If the office and the VPC both use 10.0.0.0/16, routers cannot tell which network an address belongs to. Choose ranges that do not overlap from the start.

Cloud and traditional networks side by side

• Switches and routers become virtual subnets and route tables.
• Firewalls become security groups.
• You create networks with code or a console in minutes, not weeks.
• You pay for what you use, but you must also watch your settings, because one mistake can expose data to the whole internet.